Are Random Generated Passwords Secure?

Question

Apps like Roboform that allows generate random password. Maybe there are hacker programs that are smart and know how password generators work which lets them crack passwords easier? Maybe they know some pattern?

Also what do you think about LastPass? You passwords are stored in the cloud somewhere. Who knows what can happen there... Administrators may get curious or hackers can hack cloud.

Answer 1

Probably. It's random, it could come out as password1!

Or more accurately, Yes, they're secure. They're not truly pseudorandom (Or at least, any good generator, like you'd find in a proper password management application), but follow rules designed to create passwords that aren't random, but very hard to guess.

Password cracking is a known, predictable thing, and you can use that to create passwords that are effective at resisting it. Not dictionary words, long, with symbols, both cases of letters, numbers, so on. Generating a password that would take a modern machine a few million years to crack is not a difficult challenge - because while the people writing the crackers know how the generator works, the people writing the generator know how the crackers work too.

As for lastpass, as far as I know your password container is encrypted and decrypted locally, so very, very little chance of that ever being compromised. Unfortunately, you cannot use lastpass to protect your lastpass container, so you'll have to rely on your own password generating skills to remember that one!

Answer 2

If the itake parameters of the password generating routine are completely independent of the context that the password is being generated for (example: it does not ask for website url, and login name and include this data in a repeatable way while generating the password) then one can be relatively certain that any password generated by this routine would be sufficiently strong (given adequate length and complexity).

If any of the machines involved in the above scenario are comprimised in any way the certainty that the password can provide any level of security can be diminished.